First published: Mon Dec 05 2022(Updated: )
The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Credit: contact@wpscan.com
Affected Software | Affected Version | How to fix |
---|---|---|
Themeum Wp Page Builder | <=1.2.8 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2022-3830 is medium with a CVSS score of 4.8.
The affected software of CVE-2022-3830 is the WP Page Builder WordPress plugin through version 1.2.8.
The vulnerability type of CVE-2022-3830 is Stored Cross-Site Scripting (Stored XSS).
A high privilege user, such as an admin, can exploit CVE-2022-3830 through Stored Cross-Site Scripting (Stored XSS) attacks.
There is no information available about a patch for CVE-2022-3830 at the moment. It is recommended to update to the latest version of the WP Page Builder plugin if available.